Traceroute maps the routers between you and a destination by sending packets with a time-to-live (TTL) of 1, then 2, then 3, and so on. Each router that drops an expired packet replies with an ICMP "time exceeded" message, which reveals its address and the round-trip time. The list of replies is the path.
What is actually happening on the wire?
Every IP packet carries a TTL field. Each router that forwards the packet reduces it by one. RFC 792, the original ICMP specification, says that if a gateway finds the time to live field is zero it must discard the datagram, and it may notify the source with a Time Exceeded message (type 11, code 0).
Traceroute exploits that. The first probe has TTL 1, so the first router discards it and answers. The second probe has TTL 2 and expires at the second router. Repeat until a probe reaches the destination.
What the destination sends back depends on the probe. The Unix-style tool traditionally sends UDP packets to a high port number that nothing listens on, so the destination answers with ICMP "destination unreachable, port unreachable" (type 3, code 3 in RFC 792). That tells the tool it has arrived. The Windows tracert command sends ICMP echo requests instead, and the destination answers with an echo reply. For IPv6, the same idea applies using ICMPv6 Time Exceeded messages defined in RFC 4443.
Most implementations send three probes per hop, which is why you see three time values per line.
What does the output look like?
A constructed example, using addresses reserved for documentation:
1 192.0.2.1 1.2 ms 1.0 ms 1.1 ms
2 198.51.100.9 8.4 ms 8.1 ms 8.6 ms
3 * * *
4 203.0.113.30 31.0 ms 30.7 ms 31.2 ms
5 203.0.113.77 32.1 ms 31.9 ms 32.4 ms
Hop 1 is the local gateway. Hop 2 is likely the internet provider's edge. Hop 3 shows stars, and the trace carries on at hop 4, so the path works. The jump from 8 ms to 31 ms between hops 2 and 4 suggests a long physical link, such as a regional backbone span.
What do stars and odd numbers mean?
Stars (* * *). No reply arrived within the timeout. Many routers are set not to answer expired probes, or they rate limit ICMP. A star in the middle of an otherwise complete trace is usually harmless. A trace that stops with stars from some hop onward, and never reaches the target, deserves attention, but the break may be a firewall at the end and not a failed link.
A high time at one hop that disappears later. Routers treat answering probes as low priority work. A slow reply from hop 6 followed by fast replies from hops 7 and 8 means hop 6 was slow to answer you, not that it was slow to forward traffic.
A high time that stays high. If latency rises at one hop and every later hop is also high, that is where the delay starts.
Different paths on different runs. Load balancers and equal cost routing can send each probe down a different path, so a single trace may stitch together hops from more than one route. Return paths can also differ from forward paths, and traceroute only shows the forward one.
What can it not tell you?
It does not show packet loss on the return path, application slowness, or whether a firewall treats your real traffic the way it treats the probes. Blocked ICMP can make a healthy path look broken, and some networks answer probes in ways that hide their internal layout.
How to check or apply this
- Run the trace from the affected machine to the target, then from another network if you can.
- Note the last hop that answers and whether later hops reply.
- Find the first hop where latency rises and stays high.
- Re-run a few times to see if the path changes.
- Try an alternative probe type, such as TCP to the actual service port, when ICMP or UDP seems filtered.
- Attach full output when you open a ticket with a provider.
Quick check
Does a star mean the link is down?
Not by itself. It means no reply to that probe. Check whether later hops respond before deciding.
Why do I see three times per hop?
Most tools send three probes per TTL value, and each time is the round trip for one probe.
Sources
Last reviewed: 18 October 2026.
